@allbluecn/web-app 0.19.2 → 0.19.4

package/src/components/workspace/members/workspace-member-item.tsx

@@ -16,6 +16,7 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { X } from "lucide-react";
+import { Button } from "@/components/ui/button";
 import { UserAvatar } from "@/components/shared-kit";
 import type { AvatarConfig } from "@allbluecn/kernel";
 import { m } from "@/paraglide/messages.js";
@@ -35,16 +36,8 @@ interface WorkspaceMemberCardProps {
   onRemove: (userId: string, username: string) => void;
 }
 
-const ROLE_LABELS: Record<string, () => string> = {
-  owner: () => m.workspace_home_role_owner(),
-  admin: () => m.workspace_home_role_admin(),
-  member: () => m.workspace_home_role_member(),
-  viewer: () => m.workspace_home_role_viewer(),
-};
-
 export function WorkspaceMemberItem({ member, workspaceOwnerId, onRemove }: WorkspaceMemberCardProps) {
   const isOwner = member.userId === workspaceOwnerId;
-  const roleLabel = ROLE_LABELS[member.role ?? "member"]?.() ?? m.workspace_home_role_member();
 
   return (
     <div className="flex items-center gap-3 py-2">
@@ -66,13 +59,16 @@ export function WorkspaceMemberItem({ member, workspaceOwnerId, onRemove }: Work
           </span>
         )}
         {!isOwner && (
-          <button
-            onClick={() => onRemove(member.userId, member.user?.username ?? "")}
-            className="rounded p-1 text-muted-foreground hover:text-destructive hover:bg-destructive/10 transition-colors"
+          <Button
+            type="button"
+            variant="ghost"
+            size="icon"
+            className="size-6 text-muted-foreground hover:bg-destructive/10 hover:text-destructive"
             aria-label={m.workspace_home_removeMemberConfirm()}
+            onClick={() => onRemove(member.userId, member.user?.username ?? "")}
           >
             <X className="size-3.5" />
-          </button>
+          </Button>
         )}
       </div>
     </div>

package/src/components/workspace/members/workspace-members-manager.tsx

@@ -31,7 +31,6 @@ import {
 import {
   Tooltip,
   TooltipContent,
-  TooltipProvider,
   TooltipTrigger,
 } from "@/components/ui/tooltip";
 import {
@@ -41,6 +40,7 @@ import {
   SelectTrigger,
   SelectValue,
 } from "@/components/ui/select";
+import { Checkbox } from "@/components/ui/checkbox";
 import { UserAvatar } from "@/components/shared-kit";
 import type { AvatarConfig } from "@allbluecn/kernel";
 import { NameConfirmDialog } from "@/components/shared-kit/dialogs/name-confirm-dialog";
@@ -92,13 +92,24 @@ export function WorkspaceMembersManager({ workspaceId, workspaceOwnerId, members
   const [pendingRemoveUserName, setPendingRemoveUserName] = useState("");
 
   useEffect(() => {
-    if (memberDialogOpen) {
-      setTeamUsersLoading(true);
-      listTeamUsersFn()
-        .then((data) => setTeamUsers(data as TeamUser[]))
-        .catch(() => {})
-        .finally(() => setTeamUsersLoading(false));
-    }
+    if (!memberDialogOpen) return;
+    // cancelled 守卫：快速关开弹窗时旧响应不得覆盖新数据（同 kb-manage-dialog 口径）
+    let cancelled = false;
+    setTeamUsersLoading(true);
+    listTeamUsersFn()
+      .then((data) => {
+        if (!cancelled) setTeamUsers(data as TeamUser[]);
+      })
+      .catch((err) => {
+        // 加载失败不再静默吞成「暂无成员」（审计 A7x 🟡）
+        if (!cancelled) toastError(err, m.workspace_home_loadMembersFailed());
+      })
+      .finally(() => {
+        if (!cancelled) setTeamUsersLoading(false);
+      });
+    return () => {
+      cancelled = true;
+    };
   }, [memberDialogOpen]);
 
   const filteredTeamUsers = teamUsers.filter(
@@ -191,16 +202,15 @@ export function WorkspaceMembersManager({ workspaceId, workspaceOwnerId, members
             <Users className="size-4 text-muted-foreground" />
             <h2 className="text-base font-semibold">{m.workspace_home_members()}</h2>
           </div>
-          <TooltipProvider>
-            <Tooltip>
-              <TooltipTrigger render={<Button variant="ghost" size="icon" onClick={openAddMember} aria-label={m.workspace_home_addMember()} />}>
-                  <UserPlus className="size-3.5" />
-                </TooltipTrigger>
-              <TooltipContent>
-                <p>{m.workspace_home_addMember()}</p>
-              </TooltipContent>
-            </Tooltip>
-          </TooltipProvider>
+          {/* TooltipProvider 已在 Providers 全局单例包裹（审计 A7x 🟡：组件内禁止再套） */}
+          <Tooltip>
+            <TooltipTrigger render={<Button variant="ghost" size="icon" onClick={openAddMember} aria-label={m.workspace_home_addMember()} />}>
+                <UserPlus className="size-3.5" />
+              </TooltipTrigger>
+            <TooltipContent>
+              <p>{m.workspace_home_addMember()}</p>
+            </TooltipContent>
+          </Tooltip>
         </div>
         {members.length === 0 ? (
           <p className="py-6 text-center text-sm text-muted-foreground">{m.workspace_home_membersPlaceholder()}</p>
@@ -249,8 +259,11 @@ export function WorkspaceMembersManager({ workspaceId, workspaceOwnerId, members
                   const isOwner = user.seatType === "owner";
                   const isSelected = selectedUserIds.includes(user.id);
                   return (
-                    <label
+                    <div
                       key={user.id}
+                      onClick={() => {
+                        if (!isOwner) toggleUser(user.id);
+                      }}
                       className={`flex items-center gap-3 px-3 py-2.5 transition-colors ${
                         isOwner
                           ? "cursor-not-allowed opacity-60"
@@ -259,13 +272,13 @@ export function WorkspaceMembersManager({ workspaceId, workspaceOwnerId, members
                             : "cursor-pointer hover:bg-accent"
                       }`}
                     >
-                      <input
-                        type="checkbox"
-                        value={user.id}
+                      <Checkbox
                         checked={isSelected}
                         disabled={isOwner}
-                        onChange={() => toggleUser(user.id)}
-                        className="accent-primary"
+                        onCheckedChange={() => toggleUser(user.id)}
+                        onClick={(e) => e.stopPropagation()}
+                        aria-label={user.username}
+                        className="shrink-0"
                       />
                       <UserAvatar
                         name={user.username}
@@ -281,7 +294,7 @@ export function WorkspaceMembersManager({ workspaceId, workspaceOwnerId, members
                         </span>
                       )}
                       <span className="text-xs text-muted-foreground ml-auto">{user.email}</span>
-                    </label>
+                    </div>
                   );
                 })
               )}

package/src/components/workspace/projects/workspace-project-list.tsx

@@ -22,6 +22,7 @@ import { Card } from "@/components/ui/card";
 import { LucideIconByName } from "@/components/shared-kit/icons/lucide-icon-picker/lucide-icon-by-name";
 import { CreateProjectDialog } from "@/components/project/create-project-dialog";
 import { m } from "@/paraglide/messages.js";
+import { getLocale } from "@/paraglide/runtime.js";
 import { useState } from "react";
 
 interface WorkspaceProject {
@@ -42,42 +43,9 @@ interface WorkspaceProjectListProps {
 export function WorkspaceProjectList({ projects, workspaceId, workspaceName }: WorkspaceProjectListProps) {
   const [createOpen, setCreateOpen] = useState(false);
 
-  if (projects.length === 0) {
-    return (
-      <div>
-        <div className="mb-4 flex items-center justify-between">
-          <div className="flex items-center gap-2">
-            <FolderKanban className="size-4 text-muted-foreground" />
-            <h2 className="text-base font-semibold">{m.workspace_detail_projects()}</h2>
-          </div>
-          <Button onClick={() => setCreateOpen(true)} size="sm">
-            <Plus className="size-4" />
-            {m.workspace_detail_createProject()}
-          </Button>
-        </div>
-        <Card className="flex flex-col items-center justify-center gap-4 p-12 text-center">
-          <div className="flex size-14 items-center justify-center rounded-full bg-muted">
-            <Box className="size-7 text-muted-foreground" />
-          </div>
-          <div>
-            <h3 className="text-lg font-medium">{m.workspace_detail_emptyProjectsTitle()}</h3>
-            <p className="mt-1 text-sm text-muted-foreground">
-              {m.workspace_detail_emptyProjectsDescription()}
-            </p>
-          </div>
-        </Card>
-        <CreateProjectDialog
-          open={createOpen}
-          onOpenChange={setCreateOpen}
-          defaultWorkspaceId={workspaceId}
-          defaultWorkspaceName={workspaceName}
-        />
-      </div>
-    );
-  }
-
   return (
     <div>
+      {/* 头部/对话框单实例（审计 A7x 🔵）：空态/非空仅列表区切换，新增头部能力不再改两处 */}
       <div className="mb-4 flex items-center justify-between">
         <div className="flex items-center gap-2">
           <FolderKanban className="size-4 text-muted-foreground" />
@@ -88,36 +56,52 @@ export function WorkspaceProjectList({ projects, workspaceId, workspaceName }: W
           {m.workspace_detail_createProject()}
         </Button>
       </div>
-      <div className="grid gap-4 sm:grid-cols-2">
-        {projects.map((project) => (
-          <Card key={project.id} className="group relative p-5 transition-colors hover:bg-accent/40 border rounded-lg">
-            <Link
-              to="/projects/$projectId"
-              params={{ projectId: project.id }}
-              className="absolute inset-0"
-              aria-label={project.name}
-            />
-            <div className="flex-1">
-              <div className="flex size-10 items-center justify-center rounded-lg bg-primary/10">
-                <LucideIconByName name={project.icon} size={20} />
+
+      {projects.length === 0 ? (
+        <Card className="flex flex-col items-center justify-center gap-4 p-12 text-center">
+          <div className="flex size-14 items-center justify-center rounded-full bg-muted">
+            <Box className="size-7 text-muted-foreground" />
+          </div>
+          <div>
+            <h3 className="text-lg font-medium">{m.workspace_detail_emptyProjectsTitle()}</h3>
+            <p className="mt-1 text-sm text-muted-foreground">
+              {m.workspace_detail_emptyProjectsDescription()}
+            </p>
+          </div>
+        </Card>
+      ) : (
+        <div className="grid gap-4 sm:grid-cols-2">
+          {projects.map((project) => (
+            <Card key={project.id} className="group relative p-5 transition-colors hover:bg-accent/40 border rounded-lg">
+              <Link
+                to="/projects/$projectId"
+                params={{ projectId: project.id }}
+                className="absolute inset-0"
+                aria-label={project.name}
+              />
+              <div className="flex-1">
+                <div className="flex size-10 items-center justify-center rounded-lg bg-primary/10">
+                  <LucideIconByName name={project.icon} size={20} />
+                </div>
+                <h3 className="mt-4 font-medium text-lg">{project.name}</h3>
+                <p className="mt-1 line-clamp-2 text-sm text-muted-foreground">
+                  {project.description || m.workspace_detail_noDescription()}
+                </p>
               </div>
-              <h3 className="mt-4 font-medium text-lg">{project.name}</h3>
-              <p className="mt-1 line-clamp-2 text-sm text-muted-foreground">
-                {project.description || m.workspace_detail_noDescription()}
-              </p>
-            </div>
-            <div className="mt-4 flex items-center justify-between text-xs text-muted-foreground">
-              <span className="flex items-center gap-1">
-                <Users className="size-3.5" />
-                {project._count.members} {m.workspace_detail_members()}
-              </span>
-              <span className="flex items-center gap-1">
-                <span>{new Intl.DateTimeFormat("zh-CN", { month: "short", day: "numeric" }).format(new Date(project.updatedAt))}</span>
-              </span>
-            </div>
-          </Card>
-        ))}
-      </div>
+              <div className="mt-4 flex items-center justify-between text-xs text-muted-foreground">
+                <span className="flex items-center gap-1">
+                  <Users className="size-3.5" />
+                  {project._count.members} {m.workspace_detail_members()}
+                </span>
+                <span className="flex items-center gap-1">
+                  {/* 跟随 paraglide locale（原硬编码 zh-CN 英文界面下仍显中文格式） */}
+                  <span>{new Intl.DateTimeFormat(getLocale(), { month: "short", day: "numeric" }).format(new Date(project.updatedAt))}</span>
+                </span>
+              </div>
+            </Card>
+          ))}
+        </div>
+      )}
       <CreateProjectDialog
         open={createOpen}
         onOpenChange={setCreateOpen}

package/src/components/workspace/schemas/create-workspace.ts

@@ -18,10 +18,19 @@
 import { z } from "zod"
 import { m } from "@/paraglide/messages.js";
 
-export const createWorkspaceSchema = z.object({
-  name: z.string().min(1, m.workspace_createWorkspace_nameRequired()),
-  description: z.string(),
-  icon: z.string().default("folder"),
+/**
+ * 工作空间创建/编辑共用表单 schema（审计 A7x ⚪：原名 createWorkspaceSchema 在编辑态
+ * 复用造成命名错位，更名 workspaceFormSchema）。长度上限与 UI maxLength(100/500) 及
+ * serverFn createSchema 对齐；icon 由 LucideIconPicker 提供非自由文本，不设 max。
+ * icon 不用 .default()——default 会让 validator input 类型含 undefined，迫使挂载点 as any。
+ */
+export const workspaceFormSchema = z.object({
+  name: z
+    .string()
+    .min(1, m.workspace_createWorkspace_nameRequired())
+    .max(100, m.workspace_createWorkspace_nameTooLong()),
+  description: z.string().max(500, m.workspace_createWorkspace_descriptionTooLong()),
+  icon: z.string(),
 })
 
-export type CreateWorkspaceValues = z.infer<typeof createWorkspaceSchema>
+export type WorkspaceFormValues = z.infer<typeof workspaceFormSchema>

package/src/config/sidebar-routes.tsx

@@ -32,7 +32,7 @@ export type RouteSubItem = {
   title: () => string;
   link: string;
   id: string;
-  badge: () => string;
+  badge?: () => string;
   icon?: React.ReactNode | string;
 };
 
@@ -41,7 +41,7 @@ export type Route = {
   title: () => string;
   icon?: React.ReactNode;
   link: string;
-  badge: () => string;
+  badge?: () => string;
   subs?: RouteSubItem[];
   /**
    * 模块级 presence 头像组渲染工厂（§8.2）。入参为 route.id 经 MODULE_ROUTES
@@ -56,56 +56,48 @@ export const workspaceRoutes: Route[] = [
     id: "home",
     title: m.common_nav_workspace,
     icon: <Sparkles className="size-4" />,
-    badge: () => " ",
     link: "/dashboard",
   },
   {
     id: "harness",
     title: m.common_nav_harness,
     icon: <SquareTerminal className="size-4" />,
-    badge: () => " ",
     link: "/harness",
   },
   {
     id: "inspiration",
     title: m.common_nav_inspiration,
     icon: <Lightbulb className="size-4" />,
-    badge: () => " ",
     link: "/inspiration",
   },
   {
     id: "story",
     title: m.common_nav_story,
     icon: <ClipboardList className="size-4" />,
-    badge: () => " ",
     link: "/stories",
   },
   {
     id: "design",
     title: m.common_nav_design,
     icon: <PenTool className="size-4" />,
-    badge: () => " ",
     link: "/design",
   },
   {
     id: "testcase",
     title: m.common_nav_testcase,
     icon: <FlaskConical className="size-4" />,
-    badge: () => " ",
     link: "/test-cases",
   },
   {
     id: "bug",
     title: m.common_nav_bug,
     icon: <Bug className="size-4" />,
-    badge: () => " ",
     link: "/bugs",
   },
   {
     id: "task",
     title: m.common_nav_task,
     icon: <ListTodo className="size-4" />,
-    badge: () => " ",
     link: "/tasks",
   },
 ];

package/src/design-engine/ai/ai.ts

@@ -304,10 +304,18 @@ export function sanitizeAiScene(raw: unknown, registeredTypes: Set<string>): Sce
     seen.add(node.id)
   }
 
+  // 第一遍先定稿全部最终 id：parentId 解析若在遍历中增量建表，模型输出
+  // 「子先于父」（schema 未约束顺序）时子节点 parentId miss 被错误挂到 board
+  // 顶层，父容器相对坐标随之渲染错位
   const idMap = new Map<string, string>()
-  const nodes: SceneNode[] = kept.map((node) => {
-    const id = node.id && !duplicateIds.has(node.id) ? node.id : generateNodeId(seen)
-    if (node.id) idMap.set(node.id, id)
+  const finalIds = kept.map((node) =>
+    node.id && !duplicateIds.has(node.id) ? node.id : generateNodeId(seen),
+  )
+  kept.forEach((node, i) => {
+    if (node.id) idMap.set(node.id, finalIds[i])
+  })
+  const nodes: SceneNode[] = kept.map((node, i) => {
+    const id = finalIds[i]
     const parentId = node.parentId ? idMap.get(node.parentId) ?? BOARD_NODE_ID : null
     return {
       ...node,
@@ -319,11 +327,24 @@ export function sanitizeAiScene(raw: unknown, registeredTypes: Set<string>): Sce
       y: node.y,
       width: node.width,
       height: node.height,
+      // AI 产出 style 键白名单过滤（写侧 style 通道全量 spread 进 leafer
+      // config，任意键注入收口在 AI 入口）
+      style: sanitizeAiStyle(node.style),
     } as SceneNode
   })
 
-  if (!nodes.some((node) => node.id === BOARD_NODE_ID)) {
-    seen.delete(BOARD_NODE_ID)
+  // AI 可产出任意 id 的普通节点：伪造 id="board" 冒充画板根会让文档缺失真
+  // board（下游 docToScene 以 nodes[0] 几何兜底，层级/几何语义漂移）。占用者
+  // 一律强制改名让位（子节点 parentId 引用同步修正），再确保存在真实 board 根
+  const impostor = nodes.find((node) => node.id === BOARD_NODE_ID && node.type !== "board")
+  if (impostor) {
+    const renamed = generateNodeId(seen)
+    for (const node of nodes) {
+      if (node.parentId === BOARD_NODE_ID) node.parentId = renamed
+    }
+    impostor.id = renamed
+  }
+  if (!nodes.some((node) => node.id === BOARD_NODE_ID && node.type === "board")) {
     nodes.unshift(createBoardNode(parsed.meta?.device ?? "desktop"))
   }
 
@@ -336,6 +357,53 @@ export function sanitizeAiScene(raw: unknown, registeredTypes: Set<string>): Sce
   }
 }
 
+/** AI 产出 style 键白名单（防御纵深）：style 经写侧 genericElement/leafConfigOf
+ *  全量 spread 进 leafer config（z.record(z.unknown()) 直达运行时），白名单
+ *  收敛为 doc 层已知样式键；涂装结构化通道是 fills/strokes，fill/stroke 层里的
+ *  image/shader（url 类）paint 不开放给 AI，整层丢弃。仅作用于 AI 入口——
+ *  引擎读侧（leaferToDoc）黑名单收集的 leafer 原生键 round-trip 不受影响 */
+const AI_STYLE_KEY_WHITELIST: ReadonlySet<string> = new Set([
+  "fill",
+  "stroke",
+  "strokeWidth",
+  "strokeAlign",
+  "cornerRadius",
+  "opacity",
+  "blendMode",
+  "scaleX",
+  "scaleY",
+  // 文本排版（模型可能把 shapePropsSchema 的排版字段写进 style）
+  "fontSize",
+  "fontWeight",
+  "lineHeight",
+  "letterSpacing",
+  "fontFamily",
+  "textAlign",
+  "verticalAlign",
+  // 描边变体（读侧 style 通道合法回传的 leafer 原生键）
+  "dashPattern",
+  "strokeCap",
+  "strokeJoin",
+])
+
+function isAiBlockedPaintLike(value: unknown): boolean {
+  if (Array.isArray(value)) return value.some(isAiBlockedPaintLike)
+  if (!value || typeof value !== "object") return false
+  const paint = value as { type?: unknown; url?: unknown }
+  return typeof paint.url === "string" || paint.type === "image" || paint.type === "shader"
+}
+
+function sanitizeAiStyle(raw: unknown): Record<string, unknown> {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return {}
+  const out: Record<string, unknown> = {}
+  for (const [key, value] of Object.entries(raw)) {
+    if (!AI_STYLE_KEY_WHITELIST.has(key)) continue
+    if ((key === "fill" || key === "stroke") && isAiBlockedPaintLike(value)) continue
+    out[key] = value
+  }
+  return out
+}
+
 // ===== AI 流式 op 节点级 sanitize（FS-8.2：sanitizeAiScene 的节点级子集）=====
 
 /** AI 流式生成可产出节点类型白名单：SHAPE_TYPES + COMPONENT_TYPES。
@@ -424,6 +492,8 @@ export function sanitizeAiNodes(
       id,
       parentId: null,
       kind,
+      // 同 sanitizeAiScene：AI 入口 style 白名单过滤
+      style: sanitizeAiStyle(node.style),
       fills: node.fills?.map(normalizeAiPaint),
       strokes: node.strokes?.map(normalizeAiStroke),
     })

package/src/design-engine/ai/server-registry.ts

@@ -43,10 +43,18 @@ export function serverRegisteredTypes(): Set<string> {
 const TYPE_META: Record<string, [name: string, category: string]> = {
   board: ["画板", "画板"],
   group: ["分组", "分组容器"],
+  frame: ["画框", "画板"],
   rect: ["矩形", "图形"],
   ellipse: ["椭圆", "图形"],
   line: ["直线", "图形"],
   arrow: ["箭头", "图形"],
+  // FS-2.4 新类型（registerShapes 注册进白名单，catalog 缺条目会回退「其他」，
+  // 降低模型选型质量）
+  polygon: ["多边形", "图形"],
+  star: ["星形", "图形"],
+  path: ["路径", "图形"],
+  // 旧钢笔类型（读侧惰性迁移为 path），存量注册仍在白名单内，catalog 保留
+  // 中文名避免回退「其他」；注册移除属 canvas registry 批次
   "pen-path": ["自由路径", "图形"],
   text: ["文本", "文本"],
   button: ["按钮", "组件"],

package/src/design-engine/document/serialize-leafer-json.ts

@@ -104,8 +104,11 @@ function hasShaderUrlPaint(value: unknown): boolean {
 const VIEWPORT_ROOT_KEYS = new Set(["x", "y", "scaleX", "scaleY", "rotation", "skewX", "skewY"])
 
 export function exportLeaferJSON(doc: SceneDocument, tree: ILeaf): LeaferJSONPackage {
-  const raw =
-    (tree as unknown as { toJSON?: () => Record<string, unknown> }).toJSON?.() ?? {}
+  // 先 deepCloneSafe 再删键：若 leafer toJSON 返回复用的内部对象（而非新建
+  // 普通对象），就地 delete 会破坏运行中的树视图状态
+  const raw = (deepCloneSafe(
+    (tree as unknown as { toJSON?: () => Record<string, unknown> }).toJSON?.() ?? {},
+  ) ?? {}) as Record<string, unknown>
   for (const key of VIEWPORT_ROOT_KEYS) delete raw[key]
   const extensions: Record<string, SceneNodeExtensions> = {}
   for (const node of doc.nodes) {
@@ -127,21 +130,28 @@ export function exportLeaferJSON(doc: SceneDocument, tree: ILeaf): LeaferJSONPac
     format: "leafer-json",
     version: 1,
     meta: { ...doc.meta },
-    tree: (deepCloneSafe(raw) ?? {}) as Record<string, unknown>,
+    tree: raw,
   }
   if (Object.keys(extensions).length) pkg.extensions = extensions
   return pkg
 }
 
+// device 白名单（对齐 ai.ts 的 device enum 校验）：meta.device 为任意字符串时
+// 回落 desktop，脏值不再随 doc.meta 流转
+function parseDeviceOf(value: unknown): DeviceType {
+  return value === "tablet" || value === "mobile" ? value : "desktop"
+}
+
 // 官方 JSON → SceneDocument（运行时业务包装）：复用 leaferToDoc 读侧
 // （其输入本就是 toJSON 产物形态），extensions 回填后统一 sanitize
 export function parseLeaferJSON(pkg: LeaferJSONPackage): SceneDocument {
-  const doc = leaferToDoc(pkg.tree as unknown as ILeaf, { device: pkg.meta?.device })
-  if (pkg.meta?.background !== undefined) doc.meta.background = pkg.meta.background
+  const device = parseDeviceOf(pkg.meta?.device)
+  const doc = leaferToDoc(pkg.tree as unknown as ILeaf, { device })
+  if (typeof pkg.meta?.background === "string") doc.meta.background = pkg.meta.background
   if (pkg.extensions) {
     for (const node of doc.nodes) {
-      const ext = pkg.extensions[node.id]
-      if (!ext) continue
+      const ext: unknown = pkg.extensions[node.id]
+      if (!ext || typeof ext !== "object" || Array.isArray(ext)) continue
       for (const key of EXTENSION_KEYS) {
         const value = (ext as Record<string, unknown>)[key]
         if (value === undefined) continue

package/src/design-engine/document/serialize-sanitize.ts

@@ -128,11 +128,29 @@ export function sanitizeScene(input: unknown): SceneDocument {
 }
 
 export function trimScene(doc: SceneDocument): SceneDocument {
-  const board = doc.nodes[0] ?? createBoardNode()
-  const nodes = [board, ...doc.nodes.slice(1)].map((node) => ({ ...node }))
+  // board 锚点显式按 id 校验：nodes[0] 非 board 的脏文档不再把普通节点当
+  // board 保留、裁掉其后的真实 board
+  const boardIndex = doc.nodes.findIndex((node) => node.id === BOARD_NODE_ID)
+  const anchorIndex = boardIndex >= 0 ? boardIndex : 0
+  const board = doc.nodes[anchorIndex] ?? createBoardNode()
+  const nodes = [board, ...doc.nodes.filter((_, i) => i !== anchorIndex)].map((node) => ({ ...node }))
+  // 超限时按「单节点字节后缀和」从尾部精确弹出（每节点只序列化一次，O(n)）：
+  // 旧实现对每次 pop 全量 JSON.stringify 整份文档，接近 800KB 软上限的脏文档
+  // 为 O(n²)，保存路径可感知卡顿；尾部 while 精校兜住逗号等字节差
+  const serialize = (): string => JSON.stringify({ version: 1, meta: doc.meta, nodes })
+  if (serialize().length > SCENE_SOFT_LIMIT && nodes.length > 1) {
+    const sizes = nodes.map((node) => JSON.stringify(node).length)
+    let over = serialize().length - SCENE_SOFT_LIMIT
+    let drop = 0
+    while (drop < nodes.length - 1 && over > 0) {
+      over -= sizes[nodes.length - 1 - drop]
+      drop += 1
+    }
+    nodes.length = nodes.length - drop
+  }
   while (
     nodes.length > 1 &&
-    JSON.stringify({ version: 1, meta: doc.meta, nodes }).length > SCENE_SOFT_LIMIT
+    serialize().length > SCENE_SOFT_LIMIT
   ) {
     nodes.pop()
   }